Symfony Profiler

<?php
namespace MedBrief\MSR\Security\Voter;
use InvalidArgumentException;
use MedBrief\MSR\Entity\Project;
use MedBrief\MSR\Entity\SortingSession;
use MedBrief\MSR\Entity\User;
use MedBrief\MSR\Traits\Security\Authorization\Voter\ClientSortingSessionTrait;
use Override;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
use Symfony\Component\Security\Core\User\UserInterface;
class SortingSessionVoter implements VoterInterface
{
use ClientSortingSessionTrait;
public const CREATE = 'CREATE';
public const READ = 'READ';
public const UPDATE = 'UPDATE';
public const UPDATE_SIMPLE = 'UPDATE_SIMPLE';
public const DELETE = 'DELETE';
public const ADMINISTRATION = 'ADMINISTRATION';
public const SEND_TO_SORTER = 'SEND_TO_SORTER';
public const DOWNLOAD = 'DOWNLOAD';
public const SORT = 'SORT';
public const LIST_MEMO = 'LIST_MEMO';
public const PREVIEW_MEMO = 'PREVIEW_MEMO';
public const EDIT_MEMO_NOTES = 'EDIT_MEMO_NOTES';
public const CREATE_MEMO = 'CREATE_MEMO';
public const PUSH_UNSORTED = 'PUSH_UNSORTED';
public const UNLOCK_SORT = 'UNLOCK_SORT';
public const MORE_OPTIONS = 'MORE_OPTIONS';
public const NOTE_ADMINISTRATION = 'NOTE_ADMINISTRATION';
public const PREVIEW_INDEX = 'PREVIEW_INDEX';
public const UPDATE_CENTRE = 'UPDATE_CENTRE';
public const MANAGE_RESTORE_POINT = 'MANAGE_RESTORE_POINT';
public const CANCEL_PREPROCESSING = 'CANCEL_PREPROCESSING';
public const RESUBMIT_PREPROCESSING = 'RESUBMIT_PREPROCESSING';
public function __construct(private AuthorizationCheckerInterface $authorizationChecker)
{
}
public function supportsAttribute($attribute): bool
{
return in_array($attribute, [
self::CREATE,
self::READ,
self::UPDATE,
self::UPDATE_SIMPLE,
self::DELETE,
self::ADMINISTRATION,
self::SEND_TO_SORTER,
self::DOWNLOAD,
self::SORT,
self::LIST_MEMO,
self::PREVIEW_MEMO,
self::EDIT_MEMO_NOTES,
self::CREATE_MEMO,
self::PUSH_UNSORTED,
self::UNLOCK_SORT,
self::MORE_OPTIONS,
self::NOTE_ADMINISTRATION,
self::PREVIEW_INDEX,
self::UPDATE_CENTRE,
self::MANAGE_RESTORE_POINT,
self::CANCEL_PREPROCESSING,
self::RESUBMIT_PREPROCESSING,
]);
}
public function supportsClass($class): bool
{
$supportedClass = SortingSession::class;
return $supportedClass === $class || is_subclass_of($class, $supportedClass);
}
/**
*
* @param mixed $entity
*/
#[Override]
public function vote(TokenInterface $token, $entity, array $attributes)
{
/**
* START: This is common code for all Voter::vote() methods
*/
// check if class of this object is supported by this voter
if (!$this->supportsClass($entity && !is_array($entity) ? $entity::class : '')) {
return VoterInterface::ACCESS_ABSTAIN;
}
// check if the voter is used correct, only allow one attribute
// this isn't a requirement, it's just one easy way for you to
// design your voter
if (1 !== count($attributes)) {
throw new InvalidArgumentException(
'Only one attribute is allowed for Medbrief Voters.'
);
}
// set the attribute to check against
$attribute = $attributes[0];
// check if the given attribute is covered by this voter
if (!$this->supportsAttribute($attribute)) {
return VoterInterface::ACCESS_ABSTAIN;
}
/** @var SortingSession $sortingSession */
$sortingSession = $entity;
// Grab Project this SortingSession belongs to, so we can do permission checks at the Project level.
$project = $sortingSession->getProject();
// get current logged in user
/** @var User $user */
$user = $token->getUser();
// make sure there is a user object (i.e. that the user is logged in)
if (!$user instanceof UserInterface) {
return VoterInterface::ACCESS_DENIED;
}
// Deny deletion of a sorting session to everyone except super admins
if ($attribute === self::DELETE && $this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')) {
return VoterInterface::ACCESS_GRANTED;
}
// Deny updating of sorting session/batchrequest centre to everyone except SuperAdmins
if ($attribute === self::UPDATE_CENTRE && !$this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')) {
return VoterInterface::ACCESS_DENIED;
}
// Admin users can do everything, except sort a sorting session, this is strictly controlled to the attached user.
if ($attribute !== self::SORT && $this->authorizationChecker->isGranted('ROLE_ADMIN')) {
return VoterInterface::ACCESS_GRANTED;
}
/**
* END: Common code for all Voter:vote() methods. Put custom logic below.
*/
if ($attribute === self::SORT) {
// Grant currently assigned sorter access
// This applies to both medbrief and client sorting sessions
if ($entity->getRelevantUserAssigned() === $user) {
return VoterInterface::ACCESS_GRANTED;
}
// If external editing is allowed (via the embedded DocSorter), allow all internal user types to edit all sorting sessions.
if ($entity->allowExternalEditing($user) && $user->isUserTypeInternal()) {
return VoterInterface::ACCESS_GRANTED;
}
}
$clientSessionAccess = [
self::READ,
self::SEND_TO_SORTER,
self::DOWNLOAD,
self::DELETE,
self::UPDATE_SIMPLE,
self::NOTE_ADMINISTRATION,
self::LIST_MEMO,
self::PREVIEW_MEMO,
self::EDIT_MEMO_NOTES,
self::CREATE_MEMO,
self::PREVIEW_INDEX,
];
// if user is client, grant permission to export, send-to-sorter when that client has DocSorter access and client is administrator for Account
// For the self::SORT permission, the sorting session needs to be externally editable to allow sorting. The allowedExternLEditing function encapsulates the logic for this.
if ((in_array($attribute, $clientSessionAccess) || $attribute === self::SORT && $entity->allowExternalEditing($user)) && $this->hasClientSessionAccess($project, $user, $sortingSession)) {
return VoterInterface::ACCESS_GRANTED;
;
}
// If we get to the end of this function, then no decisions have been
// made so we deny access
return VoterInterface::ACCESS_DENIED;
}
}

src/Security/Voter/SortingSessionVoter.php line 16